PT-2025-43615 · WordPress · Ai Chatbot Free Models Plugin

Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-11576

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AI Chatbot Free Models plugin for WordPress versions up to and including 1.6.5

Description The AI Chatbot Free Models plugin for WordPress is susceptible to CSV Injection due to inadequate input sanitization within the newcodebyte chatbot export messages function. This allows unauthenticated attackers to inject malicious code into exported CSV files. When a user downloads and opens these compromised files on a system with a vulnerable configuration, code execution can occur.

Recommendations Update the AI Chatbot Free Models plugin to a version newer than 1.6.5.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2025-11576

Affected Products

Ai Chatbot Free Models Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11576 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5064873b-e70a-4fe6-8c5c-ced6025aaa5f?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1981758346521629068 · Twitter Post
• https://t.me/CVEtracker/35672 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3378450 · Note